Vulnerability remediation for CVE-2026-59999, CVE-2026-60001, CVE-2026-60002

[RArr-Sail]

I reviewed the stable release page for possible timelines to resolve and did not locate it on any release page. Does anyone know if there is a roadmap or timing of when these are planned to be deployed?
https://www.flatcar.org/releases#stable-release
CVE-2026-60002 – Use-after-free vulnerability in the SSH client during host key re-exchange.
CVE-2026-60001 – sshd does not always honor the minimum authentication delay.
CVE-2026-59999 – DisableForwarding=yes does not always take precedence over PermitTunnel=yes.

[dongsupark]

We already have an issue for tracking the openssh issue. #2198
Our next regular releases would happen on the week of 2026-08-07, which should be done until Aug. 13 at latest.
While we usually do package upgrades only in Alpha, recently we discussed about possible backporting of openssh upgrades into Stable & Beta, because some folks already asked about that.
Feel free to join the #security channel of our discord.

[RArr-Sail]

Thank you very much!